Slow Forums: PF Under DDOS Attack

[rhody]

finally got the big boys to help out, let me know if there are changes in performance

Grrr.. I just lost this post after time out, hunt them Greg, show no mercy !

6:22 am EST.

Rhody...

 

[Andre]

Grrr.. I just lost this post after time out, hunt them Greg, show no mercy !

6:22 am EST.

Rhody...

It's a good habit to hit <ctrl A> and <crtl C> (windows) before clicking 'post reply'.

then when disaster strikes <ctrl V> does the trick, unstriking.

 

[lurky]

It's a good habit to hit <ctrl A> and <crtl C> (windows) before clicking 'post reply'.

then when disaster strikes <ctrl V> does the trick, unstriking.

Yeah I do that in a hurry if I notice site problems. I learned this the hard way from another forum, though.

Anyway, from my perspective, the site is not yet back to normal but it is functional.

 

[rhody]

Yeah I do that in a hurry if I notice site problems. I learned this the hard way from another forum, though.

Anyway, from my perspective, the site is not yet back to normal but it is functional.

When posting large posts, I go into gmail, and paste and save it as a draft. Have been burned many times before. I should have known better this am, but because response wasn't bad when getting into post, I assumed, wrongly, that the problem was fixed.
Live and learn I guess.

Rhody...

 

[zorro]

PF has never been this much slow for me. Any page (of PF) rarely loads and it gets stuck on 'waiting for physicsforums.com'

 

[Andre]

A couple of hours ago it seemed much better, on and off that is. Apparantly the cyber attack has been resumed.

 

[Lancelot59]

I guess. It's horribly slow.

 

[G01]

Seriously though, what has this forum ever done to anybody?

 

[Greg Bernhardt]

Seriously though, what has this forum ever done to anybody?

if only it worked that way :) PF is big enough now that it's a target for any reason.

 

[caffenta]

Seriously though, what has this forum ever done to anybody?

Yeah, this is getting ridiculous. What kind of total loser would attack PF?

 

[caffenta]

if only it worked that way :) PF is big enough now that it's a target for any reason.

But what for? Why would a bunch of geeks attack a bunch of nerds? It’s like running a protection racket against bums. What are they going to pay you with? Dirty socks? It makes no sense I tells ya.

 

[Greg Bernhardt]

This has escalated into a very serious attack. I appreciate everyone's patience!

 

[rhody]

This has escalated into a very serious attack. I appreciate everyone's patience!

Until the US gets SERIOUS about forming a task force (Homeland Secuirty, Dept of Commerce, etc...) to identify, and take out these miscreants, this will continue.

People will continue their bad behavior unabated, until a little emotion known as fear takes over. Fear from the example of the newly formed task forces ability to identify, arrest, detain, and deport said troublemakers. Once they (the bad guys) figure out the stakes just got exceedingly high, many, if not most will change their habits. What will remain are the insane, mentally ill and terrorist types. It is in every civilized country's interest to participate, and the US could lead the way. Enough ranting, there, I feel better, well, just a little.

Rhody...

 

[pergradus]

AHHHHHH this is crazy!

Are you sure its really a DOS and not some other server problem? How can you tell the difference?

 

[Greg Bernhardt]

Are you sure its really a DOS and not some other server problem? How can you tell the difference?

http://en.wikipedia.org/wiki/Netstat

 

[ladykrimson]

Did you recently suspend or ban any users?

 

[Greg Bernhardt]

Did you recently suspend or ban any users?

we do every day

 

[ladykrimson]

we do every day

That might be a good place to begin looking for suspects.

 

[nismaratwork]

we were attacked this morning/afternoon. the firewall is still catching up, so things might still be a little slow for a bit

Was this an attack on PF itself, or its bandwidth provider? It seems... odd to attack a forum with a sledgehammer when a knife would do the job (nothing personal).

I'm familiar however, with being hosted by a company that makes the mistake of hosting some IRC channel or network, or a similar target; it gets DDOS'ed, and everyone hosted suffers.

@Ladykrimson: someone would need a botnet ready to do this, and be willing to use it up too. I've been pissed at PF before, but this is... stupid and bizarre.

edit: I'd add... it's not exactly effective, so maybe it's some exceptionally incompetant script kiddy? Who the hell can't DDOS a website anyway? I'm annoyed and disgusted.

 

[rhody]

For what it is worth:

http://www.buzzle.com/articles/free-ddos-detection-and-mitigation-tools-for-linux-servers.html"
By David Foreman
Published: 2/11/2011

From his supplied link:

David Foreman
University Of Pennsylvania graduate in 1985. Self employed real estate investor for 10 years. Now owner of Foreman and Pike Consulting, an Internet Marketing Firm.

Rhody...

P.S. Wouldn't it be cool if traceroute endroute of the responsible party(s) computer(s) were possible and to send them a little PF present of of our own.

 

[Greg Bernhardt]

Was this an attack on PF itself, or its bandwidth provider? It seems... odd to attack a forum with a sledgehammer when a knife would do the job (nothing personal).

I'm familiar however, with being hosted by a company that makes the mistake of hosting some IRC channel or network, or a similar target; it gets DDOS'ed, and everyone hosted suffers.

They are targeting PF's IP addy. We are on a dedicated server.

 

[Greg Bernhardt]

For what it is worth:

http://www.buzzle.com/articles/free-ddos-detection-and-mitigation-tools-for-linux-servers.html"

Thanks rhody. We are doing everything we can on the server and the firewall is blocking everything, but there will still be performance issues as the traffic although blocked, is still hitting the server. We need measures to be taken further up the network chain.

 

[nismaratwork]

They are targeting PF's IP addy. We are on a dedicated server.

Damn it... that's just stupid and cruel.

In my experience, there are limited ways to respond to a DOS attack:

1.) Report to authorities
2.) If you have a set number of attackers, block traffic from those subnets.
3.) Notify people and entities who's computers have been compromised
---- From here, this is speculation, hypothetical, and not an endorsement ----
4.) Compromise the botnet and sniff incoming packets directing the bots
-Backtrace... a putz like this isn't going to be on a decent networks of BNCs
-Leave a message, or disable controller
4.2) Compromise the botnet, use tools from packetstorm security, and turn it on the attacker
5.) Identify. Juno.
6.) If in a country outside of reasonable jurisdiction, identify critical resources affiliated with the botnet owner and attack them.
7.) Compromise the botnet, then shut it down without malicious means (change passwords, update, etc)
7.) Compromise with a worm.

 

[nismaratwork]

Oh, on the off chance that you don't take a militant route:

http://www.broadbandreports.com/shownews/93820

http://www.networkworld.com/community/node/42289

The first I think especially useful for such a large community of cooperative people.

 

[mugaliens]

But what for? Why would a bunch of geeks attack a bunch of nerds? It’s like running a protection racket against bums. What are they going to pay you with? Dirty socks? It makes no sense I tells ya.

Apparently, these particular geeks don't appreciate open platform discussions about some things.

Greg, have you contacted the FBI, or the RCMP? Don't know whether your server is in the U.S. or Canada. Regardless, any sustained attack like this violates some key U.S. laws of the kind the FBI takes interest. I'm also aware of certain edge (as in U.S. electronic border) tracking stations which record anything bound for any IP in the U.S. If it's routed, it can be tracked back to at least the station immediately prior. On the other hand, if it's a DDoS attack originating from virii/trojans/worms within the U.S., a call to Symantec and a couple other leading antivirus manufacturers might prove helpful. Might be helpful if it's a DDoS from the outside, as well.

 

[Greg Bernhardt]

Greg, have you contacted the FBI, or the RCMP?

I'm not sure they'd care. DoS attacks are quite common.

To make this day even worse, the FedEx man just put a package under my door handle effectively locking me in. I seriously can't get out of my apartment now. I may have to jump off my 2nd floor balcony.

 

[nismaratwork]

Apparently, these particular geeks don't appreciate open platform discussions about some things.

Greg, have you contacted the FBI, or the RCMP? Don't know whether your server is in the U.S. or Canada. Regardless, any sustained attack like this violates some key U.S. laws of the kind the FBI takes interest. I'm also aware of certain edge (as in U.S. electronic border) tracking stations which record anything bound for any IP in the U.S. If it's routed, it can be tracked back to at least the station immediately prior. On the other hand, if it's a DDoS attack originating from virii/trojans/worms within the U.S., a call to Symantec and a couple other leading antivirus manufacturers might prove helpful. Might be helpful if it's a DDoS from the outside, as well.

In my experience, if this is a sustained attack by a "pro", it's going to originate outside of the west, and beyond any kind of meaningful enforcement. Each bot might be anywhere, but not the controller of the network... still, contacting authorities is the right move... it just won't usually help.

I offer Dalnet as an example, and also as an indicator that this is just a script kiddy with only slightly more bots than brains.

 

[nismaratwork]

I'm not sure they'd care. DoS attacks are quite common.

To make this day even worse, the FedEx man just put a package under my door handle effectively locking me in. I seriously can't get out of my apartment now. I may have to jump off my 2nd floor balcony.

Jesus Greg... did you piss off a gypsy fortune teller or something?!

Um... and don't jump, just call a neighbor!

 

[vela]

Seriously though, what has this forum ever done to anybody?

Rumor has it it involves Julian Assange and Anonymous.

 

[mugaliens]

After using an exhaustive suite of computer forensics tools, I've discovered the cause of the slowdown...

It's all these posts in this thread!

 

[Evo]

I'm not sure they'd care. DoS attacks are quite common.

To make this day even worse, the FedEx man just put a package under my door handle effectively locking me in. I seriously can't get out of my apartment now. I may have to jump off my 2nd floor balcony.

Call Fedex and have them send the guy back to untrap you.

 

[Studiot]

This has escalated into a very serious attack. I appreciate everyone's patience!

Patience and whatever support we can.

That probably means just sitting the misceants out - So be it.

In particular, Greg, don't take this personally, you are doing a great job with a great site.

 

[Grep]

It's a good habit to hit <ctrl A> and <crtl C> (windows) before clicking 'post reply'.

then when disaster strikes <ctrl V> does the trick, unstriking.

Or if you run Firefox, the "Lazarus" addon saves form information for you as you go so it can be recovered if something happens. I almost never need it, but when I do, it's nice to have. It's pretty annoying typing out a long post and losing it!

 

[lurky]

I'm being patient. At this point, though, I'm curious as all heck.

 

[nismaratwork]

Rumor has it it involves Julian Assange and Anonymous.

I wish... known targets make life so much easier, and hackers have rivels.

Whoever this is...well... I hope their personal information finds it way into the hands of unscrupulous Turkish or Romanian hackers.